[improve][broker] Extract authentication logic from ServerCnx to dedicated class

[nodece]

Motivation

The current authentication flow in broker is tightly coupled with the ServerCnx class, making it harder to extend authentication logic (e.g., for proxy authentication, role forwarding). This PR refactors the authentication handling into dedicated classes to make the flow more modular, extensible, and easier to maintain.

Modifications

• Decouple authentication from server connection handling for cleaner separation of concerns
• Enable reuse of authentication logic for proxy authentication

Documentation

• doc
• doc-required
• doc-not-needed
• doc-complete

[Copilot]

Pull Request Overview

Refactors broker authentication by extracting the logic from ServerCnx into dedicated classes for modularity and reuse (e.g., proxy/original-role authentication).

• Introduces BinaryAuthSession and BinaryAuthContext to encapsulate auth flow and context
• Updates ServerCnx to delegate auth/connect/auth-response handling to BinaryAuthSession
• Adds a factory method in AuthenticationService to create BinaryAuthSession

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 8 comments.

File	Description
pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java	Replaces inline authentication logic with BinaryAuthSession orchestration during connect and auth responses.
pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/BinaryAuthSession.java	New class implementing the binary authentication flow, including proxy/original-client handling and challenges.
pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/BinaryAuthContext.java	New context container for auth session parameters (connect command, SSL, executor, etc.).
pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationService.java	Adds a simple factory method to create BinaryAuthSession.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[nodece]

/pulsarbot rerun-failure-checks

[Copilot]

Pull Request Overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[lhotari]

When adding new classes like BinaryAuthSession and BinaryAuthContext, please pay attention to add class level javadocs to explain the abstraction. It should also be considered whether an interface is used for BinaryAuthContext to make it easier to keep the API backwards compatible in the future.

It's currently not clear what the extension model is and how a custom implementation could help extend the authentication logic.

[nodece]

This implementation aims to unify authentication handling between the broker and proxy. It’s not currently designed for external extension or customization. I plan to test this in our forked Pulsar.